CVE-2021-21009: Server-Side Request Forgery (SSRF)

Adobe Campaign Classic Gold Standard 10 and earlier, 20.3.1 and earlier, 20.2.3 and earlier, 20.1.3 and earlier, 19.2.3 and earlier and 19.1.7 and earlier are affected by a server-side request forgery SSRF vulnerability. Successful exploitation could allow an attacker to use the Campaign instance...

WordPress ultimate-category-excluder plugin 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Ultimate-category-excluder Plugin...

Verve Connect VH510 Cross-Site Request Forgery Vulnerability

The Verve Connect VH510 is a hub for home applications from Verve Connect UK. The device regenerates and shapes and amplifies the received signal to extend the transmission distance of the network while concentrating all nodes on the node centered on it. Verve Connect VH510 has a cross-site reque...

CloudBees Jenkins CSRF Vulnerability (CNVD-2020-51389)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

CVE-2020-5412

Spring Cloud Netflix versions 2.2.x prior to 2.2.4, 2.1.x prior to 2.1.6, and older unsupported versions are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists in the Hystrix Dashboard proxy.stream endpoint, which allows an attacker to force the application to make requests to a...

CVE-2020-2076

SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write fil...

Authentication flaw

SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write fil...

CVE-2020-2076

SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write fil...

CVE-2020-2076

CVE-2020-2076 affects SICK Package Analytics software up to and including version V04.0.0. The issue is an authentication bypass caused by direct REST API access, enabling an attacker to issue unauthorized requests and potentially write files without authentication. Public sources in the connecte...

XML External Entity (XXE)

adal4j is vulnerable to XML External Entity XXE. The vulnerability exists because the external DTDs are not disabled by default in WSTrustResponse parse function in WSTrustResponse.java and getWsTrustEndpointFromMexResponse function in MexParser.java, allowing an attacker to submit a malicious XM...

CVE-2020-4529

IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to server side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 182713...

Server side request forgery (ssrf)

IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to server side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 182713...

WordPress Multi-Scheduler Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Multi-Scheduler is a scheduler plugin used in it. A cross-site request forgery vulnerability exists in WordPress Multi-Scheduler versio...

Aviatrix Systems Controller Cross-Site Request Forgery Vulnerability

Aviatrix Systems Controller is a centralized control panel for business processes and management of Aviatrix Systems solutions from Aviatrix Systems, USA. A cross-site request forgery vulnerability exists in Aviatrix Systems Controller versions prior to 5.4.1204. The vulnerability stems from a WE...

Ruby on Rails Cross-Site Request Forgery Vulnerability (CNVD-2020-34299)

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A cross-site request forgery vulnerability exists in Ruby on Rails 6.0.3 and earlier versions. The vulnerability stems from a web application that does not adequately validate that a request is...

CloudBees Jenkins Amazon EC2 Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Amazon EC2 Plugin is used in which an EC2 connection agen...

NETGEAR R8500 and R8300 Cross-Site Request Forgery Vulnerability

The NETGEAR R8500 and NETGEAR R8300 are both wireless routers from NETGEAR. A cross-site request forgery vulnerability exists in the NETGEAR R8300 prior to version 1.0.2.94 and the R8500 prior to version 1.0.2.94, which stems from a WEB application that does not adequately validate that a request...

IBM QRadar SIEM Server-Side Request Forgery Vulnerability (CNVD-2020-23049)

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. IBM QRadar SIEM ha...

Server side request forgery (ssrf)

IBM QRadar 7.3.0 to 7.3.3 Patch 2 is vulnerable to Server Side Request Forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-ForceID: 176404...

CVE-2020-4294

IBM QRadar SIEM (7.3.0–7.3.3 Patch 2) is vulnerable to Server-Side Request Forgery via the RssFeedItem component due to missing URL validation, potentially allowing an authenticated attacker to send unauthorized requests from the appliance (network enumeration or further attacks). Root cause: lac...